Master Password

The master password unlocks the key that encrypts your secrets, and protects access to the UI. Runeya asks for it on first launch.

What happens

The password unlocks the encryption key, and opens a session. It stays open as long as the tab does: its token, valid for 8 hours, is renewed automatically. Closing the tab or restarting Runeya ends it.

It is combined with a machine-specific secret held in the system keyring (Keychain, Secret Service, Credential Manager). Copying .runeya/ to another machine is therefore not enough to read your secrets, because the machine secret is not copied with it.

If the system keyring is not available, this secret is stored in the data folder, and this protection no longer applies.

Setting it

On first launch, the "Configure Runeya" screen asks you to choose the master password. The UI then asks for it at the start of each session.

DANGER

There is no password reset. If you lose it, you lose access to the secrets and conversations encrypted with the key it unlocks.

In CI

RUNEYA_ENCRYPTION_KEY (64 hex characters) supplies the key directly, with no master password. It also disables tRPC authentication. Use it only on CI/CD runners, never on a machine that other people can reach.